3

Comodo certs such as PositiveSSL have a chain length of 4, including two intermediate CA certs.

What would be the benefit to them, or to me, of this length chain instead of a chain length of 3 with a single intermediate CA as other providers seem to use?

I am aware that it results in a slight increase to the data exchanged during handshake. But what would be the benefit?

2 Answers 2

5

In many cases, the intermediate certs do mean something. Sometimes it mean the Insurance level (how much the signer will pay you in the event of a fraudulent verification) or it can mean the validation level (only domain verified, or full verified with Company details and Everything).

In this case, Comodo isnt even the top signer. Instead its a Company called UserTrust ( http://www.usertrust.com ). The Company is apparently owned by Comodo, which might tell that Comodo sub-licenses its certificates to other CA's so those CA's dont want "Comodo" as their top certs. Now we have travelled 2 steps down the chain.

The third certificate, in Comodo's case, tells the verification level. For the SSL cert used on Comodo's own website, that intermediate certificate tells that the site certificate is a "EV Green Adress bar" certificate. The fourth certificate is the site certificate itself.

0

One benefit could be that there are less customers per intermediate certs so if a cert is stolen, there are less people affected. Comodo has a very automated process in signing certs for customers so they may regulary create a new intermediate CA for their signing-server to prevent one cert to get too big to fail.

But this is only a personal theory, to be sure you should ask a representative of Comodo.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .